AWS cli medium security documentation change
Summary
Added new RDS configuration options (rdsPromoteReadReplicaConfig and rdsCreateCrossRegionReadReplicaConfig) with cross-account security parameters, updated region handling for recovery workflows, added CLI error format option, and updated version references
Security assessment
The changes introduce security-related parameters like crossAccountRole and externalId in the new RDS configuration blocks. These are security features for managing cross-account access and preventing confused deputy issues, which directly relate to access control and security best practices.
Diff
diff --git a/cli/latest/reference/arc-region-switch/create-plan.md b/cli/latest/reference/arc-region-switch/create-plan.md index 9b3d9d650..1c2afe273 100644 --- a//cli/latest/reference/arc-region-switch/create-plan.md +++ b//cli/latest/reference/arc-region-switch/create-plan.md @@ -15 +15 @@ - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) » @@ -100,0 +101 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re + [--cli-error-format <value>] @@ -139 +140 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`. +>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`, `rdsPromoteReadReplicaConfig`, `rdsCreateCrossRegionReadReplicaConfig`. @@ -194 +195 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>>>> The Amazon Web Services Region for the function to run in. +>>>>>>> The Amazon Web Services Region for the function to run in. For recovery workflows use `activatingRegion` or `deactivatingRegion` . For post-recovery workflows, use `activeRegion` (the Region with customer traffic) or `inactiveRegion` (the Region with no customer traffic). @@ -199,0 +201,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>> * `activeRegion` +>>>>>>> * `inactiveRegion` @@ -476 +479 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`. +>>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`, `rdsPromoteReadReplicaConfig`, `rdsCreateCrossRegionReadReplicaConfig`. @@ -531 +534 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re ->>>>>>>>>>> The Amazon Web Services Region for the function to run in. +>>>>>>>>>>> The Amazon Web Services Region for the function to run in. For recovery workflows use `activatingRegion` or `deactivatingRegion` . For post-recovery workflows, use `activeRegion` (the Region with customer traffic) or `inactiveRegion` (the Region with no customer traffic). @@ -536,0 +540,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>>>>>> * `activeRegion` +>>>>>>>>>>> * `inactiveRegion` @@ -1209,0 +1215,96 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>>>> +>>>>>>>>> rdsPromoteReadReplicaConfig -> (structure) +>>>>>>>>> +>>>>>>>>>> An Amazon RDS promote read replica execution block. +>>>>>>>>>> +>>>>>>>>>> timeoutMinutes -> (integer) +>>>>>>>>>> +>>>>>>>>>>> The timeout value specified for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * min: `1` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> crossAccountRole -> (string) +>>>>>>>>>> +>>>>>>>>>>> The cross-account role for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> externalId -> (string) +>>>>>>>>>> +>>>>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>>>>> +>>>>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>>>>> +>>>>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>>>>> +>>>>>>>>>>> key -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> value -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>>>>> + +>>>>>>>>> +>>>>>>>>> rdsCreateCrossRegionReadReplicaConfig -> (structure) +>>>>>>>>> +>>>>>>>>>> An Amazon RDS create cross-Region replica execution block. +>>>>>>>>>> +>>>>>>>>>> timeoutMinutes -> (integer) +>>>>>>>>>> +>>>>>>>>>>> The timeout value specified for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * min: `1` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> crossAccountRole -> (string) +>>>>>>>>>> +>>>>>>>>>>> The cross-account role for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> Constraints: +>>>>>>>>>>> +>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> externalId -> (string) +>>>>>>>>>> +>>>>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>>>>> +>>>>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>>>>> +>>>>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>>>>> +>>>>>>>>>>> key -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> value -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>>>>> + @@ -1227,0 +1329,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>>>>>> * `RdsPromoteReadReplica` +>>>>>>>>> * `RdsCreateCrossRegionReplica` @@ -1649,0 +1753,96 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re +>>>>> +>>>>> rdsPromoteReadReplicaConfig -> (structure) +>>>>> +>>>>>> An Amazon RDS promote read replica execution block. +>>>>>> +>>>>>> timeoutMinutes -> (integer) +>>>>>> +>>>>>>> The timeout value specified for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> + +>>>>>> +>>>>>> crossAccountRole -> (string) +>>>>>> +>>>>>>> The cross-account role for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>> + +>>>>>> +>>>>>> externalId -> (string) +>>>>>> +>>>>>>> The external ID (secret key) for the configuration. +>>>>>> +>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>> +>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>> +>>>>>>> key -> (string) +>>>>>>> +>>>>>>>> Constraints: +>>>>>>>> +>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>> + +>>>>>>> +>>>>>>> value -> (string) +>>>>>>> +>>>>>>>> Constraints: +>>>>>>>> +>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>> + +>>>>> +>>>>> rdsCreateCrossRegionReadReplicaConfig -> (structure) +>>>>> +>>>>>> An Amazon RDS create cross-Region replica execution block. +>>>>>> +>>>>>> timeoutMinutes -> (integer) +>>>>>> +>>>>>>> The timeout value specified for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> + +>>>>>> +>>>>>> crossAccountRole -> (string) +>>>>>> +>>>>>>> The cross-account role for the configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>> +